Loading Ableway
Routing…
Loading Ableway
Last Updated: August 27, 2026
This document is a plain-language companion to our Privacy Policy. It describes, in practical terms, how Ableway handles personal data and how we meet our obligations under the GDPR (EU/EEA, UK) and similar regimes. The Site is a pre-launch waitlist with an optional survey — there are no user accounts and no contributed content yet.
We collect the smallest set of data needed to run a waitlist. This is the complete list of what we store:
That is the entire data footprint. We do not store your IP address — not in the waitlist row, not in a separate table, not in a log. Your IP is read by Cloudflare at the edge and discarded; we never see it.
For measurement we keep only aggregate counts: page views go through Cloudflare Web Analytics (cookieless), and our own event counter tallies anonymous signup, survey, and referral-conversion counts. Neither sets a cookie for measurement, neither stores IP addresses, and there is no cross-site tracking and no advertising anywhere on the Site.
We do not collect names, phone numbers, payment data, photos, biometric data, precise geolocation, OAuth identifiers, device fingerprints, or advertising IDs. There is no "Sign in with Google" or any social login.
The survey is separate from the waitlist form. If you take it, your answers are stored in a dedicated survey table keyed only to your unsubscribe token — the survey store never contains your email. Answers cover how you get around, your navigation needs, feature priorities, pain points, your city, and whether you're open to a short interview. Every question is optional ("Prefer not to say" always), and questions about access needs are shown only after an explicit consent screen that names them as health data under GDPR Article 9. Answers are used for exactly one purpose: deciding what to build first and which cities to open first. They are never sold, shared, or used for advertising or profiling. Unsubscribing deletes your survey answers in the same request as your waitlist record; the 60-second undo does not restore them (you can always answer again). Answering or skipping the survey has no effect on your waitlist position.
| Processing activity | Lawful basis |
|---|---|
| Holding your place on the waitlist | Consent (you submitted the form) |
| Sending the welcome / confirmation | Contractual necessity / consent |
| Occasional launch updates | Consent (separate from the transactional welcome) |
| Referral tracking | Legitimate interest (operating the program you opted into) |
| Disposable / role-address filtering | Legitimate interest (avoiding bounces and bot signups) |
| Honeypot (bot filtering) | Legitimate interest (protecting the waitlist from abuse) |
| Survey feature/city/pain-point answers | Consent (you chose to answer) |
| Survey access-need answers | Explicit consent (GDPR Art. 9(2)(a) — dedicated consent screen) |
Consent is withdrawn the moment you ask to be removed — and removal deletes your record immediately.
We use two third-party processors. Neither uses your data for its own purposes beyond providing the service we contracted them for.
| Processor | Purpose | Data shared | Transfer safeguard |
|---|---|---|---|
| Cloudflare | Hosting, Workers runtime, D1 database, edge network | Your waitlist record (email, city) | Standard Contractual Clauses |
| MXroute | Sending the welcome and launch emails | Your email address + email content | Processing in the course of delivery |
We commit to notifying you by email before adding any new sub-processor that processes your personal data. Cloudflare observability is off for our Worker — we receive no request logs, traces, or invocation records.
The only measurement on the Site is the aggregate, cookieless counting described in §1 — Cloudflare Web Analytics plus our own event counter. There is no advertising network, no CRM, and no tracking pixel on the Site.
We honor all GDPR rights: access, rectification, erasure, restriction, portability, and objection. To exercise any of them, email privacy@ableway.co. Our target response time is 30 days. If you are in the EEA and we do not resolve your request, you may complain to your supervisory authority.
There is no inactivity-based auto-deletion today. We keep your record until you delete it or until launch.
The Site runs on Cloudflare's global edge. If you are outside the U.S., your email may be processed in the U.S. or EU. Cloudflare offers Standard Contractual Clauses for EEA-originating transfers; MXroute processes transmission in the course of email delivery.
In the event of a personal-data breach likely to result in a risk to your rights, we will notify affected users and the relevant supervisory authority without undue delay and, where feasible, within 72 hours.
When the full platform ships (accounts, contributed venue data, mobile apps), this document and the Privacy Policy will be updated to describe data collection for those features — including any new sub-processors and a proper Data Processing Agreement for business customers. Until then, the data footprint is exactly what is listed above. Note on the survey's effective date: the survey infrastructure was deployed ahead of its activation, and it is enabled deliberately. Privacy Policy §13's notice obligation (material changes get at least 14 days' emailed notice; new purposes always need explicit consent) runs to members registered at the time — the list was empty when the survey disclosures were published, so there was nobody to notify and the updated policy takes effect on publication. If members join under this policy and a later material change applies, the §13 process governs then.
Data Protection contact: privacy@ableway.co General: hello@ableway.co
This is a plain-language summary, not a substitute for the Privacy Policy. For questions, contact privacy@ableway.co.